This is my major concern with the "4 random word" approach: password crackers are extremely clever, and there may be non-obvious heuristics they can use to redu

This is my major concern with the "4 random word" approach: password crackers are extremely clever, and there may be non-obvious heuristics they can use to reduce the size of the search space. E.g. if we aren't totally committed to the method and we generate a few 4-word combos until we find one that we think is "memorable", that introduces an obvious bias that can probably be exploited. (For the record I do use the "4 random word" method for some passwords I want to be able to remember without having to open up my password manager. But I have nagging doubts about its security vs. random strings.)